This guide covers what a QMS for contract manufacturers must include, how FDA and ISO requirements apply to CMOs, and how modern electronic QMS platforms reduce the burden of managing multi-client compliance without multiplying headcount.

What makes contract manufacturer QMS requirements different

A brand owner’s QMS is built around its own products, its own processes, and its own regulatory submissions. A contract manufacturer’s QMS must do all of that and accommodate external client requirements that may conflict, overlap, or exceed the CMO’s own baseline.

Three specific pressures make this difficult.

First, quality agreements with clients create contractual QMS obligations. Under FDA’s guidance on quality agreements for contract facilities (applicable under 21 CFR Part 211 for pharmaceutical manufacturers and 21 CFR Part 820 / QMSR for medical device CMOs), the CMO and the contracting company must define in writing which quality activities each party owns. If the agreement assigns change control approval to the client, the CMO’s QMS must enforce that workflow, even when the CMO’s own internal process would allow the change to proceed faster.

Second, multi-client environments create document control complexity. A CMO producing pharmaceutical drug products for three clients may need three separate sets of batch records, three separate deviation procedures, and three separate validation packages, all running in parallel. Without a configurable QMS, this typically means spreadsheets, shared drives, and a quality team spending more time managing version control than managing quality.

Third, supplier qualification does not stop at the CMO’s door. Brand owners often require access to the CMO’s Supplier Quality Management records for raw materials and components. The CMO must be able to demonstrate, on short notice, that its material suppliers are qualified, that certificates of analysis are current, and that any supplier changes were communicated to clients before implementation.

FDA requirements for contract manufacturers

FDA’s QMSR (21 CFR Part 820, effective February 2026) aligns the U.S. medical device QMS regulation with ISO 13485:2016. For medical device CMOs, this means the full QMSR framework applies regardless of whether the CMO holds its own 510(k) or PMA. If the CMO manufactures, packages, or labels devices, it is a “manufacturer” under FDA’s definition and subject to QMSR inspection.

For pharmaceutical CMOs, 21 CFR Part 211 (cGMP for finished pharmaceuticals) applies. FDA has also issued specific guidance on quality agreements for pharmaceutical contract manufacturing operations, making the written quality agreement a regulatory expectation rather than just a commercial practice.

Key FDA requirements CMOs must satisfy include:

• Management responsibility: The CMO must maintain its own quality policy, quality objectives, and management review process. It cannot outsource quality system oversight to the brand owner.
• Document and record control: All documents and records, including client-specific batch records, must be controlled, versioned, and retrievable. FDA inspectors will ask for records by product and by lot number during inspections.
• CAPA: Deviations, nonconformances, and out-of-specification results that occur during contract manufacturing must feed into the CMO’s Deviation CAPA system. The quality agreement must specify whether the client receives CAPA notifications and within what timeframe.
• Change control: Any change to a manufacturing process, equipment, or material that could affect a client’s product requires prior notification or approval, depending on the quality agreement terms. The CMO’s change control SOP must reflect these obligations. Using a Process Change Notification workflow ensures clients are informed before changes go live.
• Supplier qualification: The CMO is responsible for qualifying suppliers of materials used in contract manufacturing. The brand owner may perform overlapping qualification but cannot substitute for the CMO’s own supplier program.

FDA inspectors conducting QMSR inspections at CMO facilities increasingly look for evidence that the CMO understands which products it manufactures are subject to which requirements, and that the QMS adapts to those requirements rather than applying a one-size-fits-all process.

ISO 13485 requirements for contract manufacturers

ISO 13485:2016 Section 4.1 addresses outsourced processes explicitly. When a brand owner outsources manufacturing to a CMO, the brand owner remains responsible for ensuring the outsourced process conforms to the standard. But the CMO also operates under ISO 13485 if it is certified or required to be by its clients.

For CMOs seeking or maintaining ISO 13485 certification, several requirements carry particular weight in a contract manufacturing context.

Section 7.4 covers purchasing and supplier control. When the CMO buys raw materials used to make a client’s product, those materials and their suppliers fall under the CMO’s purchasing control requirements. The CMO must define and document the criteria for supplier evaluation and re-evaluation, maintain supplier quality records, and be able to demonstrate that approved supplier lists are current.

Section 7.5 covers production and service provision. CMOs must demonstrate that production processes are carried out under controlled conditions, with validated processes where outputs cannot be verified by subsequent inspection. For sterile device manufacturers or manufacturers of complex pharmaceutical formulations, process validation records must be available during audits.

Section 8.2 covers monitoring and measurement. CMOs performing in-process testing, release testing, or environmental monitoring on behalf of clients must have validated test methods, calibrated equipment, and documented out-of-specification procedures. These records become part of the product’s technical file or device history record.

Quality agreements: what the CMO QMS must enforce

A quality agreement is a contract. It assigns responsibility for specific quality activities between the CMO and the client. From a QMS standpoint, the CMO’s procedures must reflect what the agreement says the CMO is responsible for doing.

Common quality agreement provisions that directly affect CMO QMS workflows include:

Deviation and nonconformance notification timelines. Many agreements require the CMO to notify the client within 24 to 72 hours of a critical deviation. The CMO’s deviation management system must support timed notifications, either automatically or through workflow-triggered tasks.

Change control approval requirements. If the agreement requires client approval before the CMO changes a validated process, the CMO’s change control module must have a mechanism to hold changes in a pending state until client sign-off is documented.

Audit rights. Most quality agreements grant the client the right to audit the CMO’s facility and quality records. The CMO’s audit management system must support multi-party audit scheduling, findings tracking, and CAPA closure documentation. The audit trail for all quality records must be intact and accessible.

Regulatory filing responsibilities. For pharmaceutical CMOs, the agreement must specify who is responsible for submitting Annual Product Reviews, reporting adverse events, and maintaining FDA registration. The CMO’s document management system must be able to segregate records by client product to support these obligations.

Supplier qualification at CMOs: what clients expect to see

When a brand owner audits a CMO, supplier qualification records are among the first items reviewed. The brand owner needs assurance that the materials going into their product come from suppliers the CMO has evaluated, approved, and actively monitors.

A functional supplier qualification program at a CMO typically covers:

Initial qualification. Before a supplier is approved, the CMO should conduct a risk-based assessment that includes a review of the supplier’s quality certifications, a questionnaire or on-site audit depending on the risk level of the material, and testing of incoming samples against specification.

Approved supplier list maintenance. The approved supplier list (ASL) must be documented, controlled, and linked to the QMS so that purchasing cannot place orders with unapproved suppliers. When a supplier is added, modified, or removed, the change must follow a defined process with documentation.

Ongoing monitoring. Certificate of Analysis review for every incoming shipment, periodic re-qualification based on risk level, and tracking of supplier-related deviations and complaints all contribute to ongoing supplier oversight. Any supplier-associated nonconformance should trigger a review of whether the supplier’s approval status needs to change.

Supplier corrective actions. When a supplier causes a quality issue, the CMO needs a formal Supplier Corrective Action Request (SCAR) process. The SCAR documents the problem, the supplier’s root cause analysis, and the corrective actions taken. This record is often reviewed during client audits and FDA inspections.

Document control in multi-client contract manufacturing

Document control at a CMO is more complex than at a brand owner because the CMO must manage both its own procedures and client-specific documents that govern how their products are manufactured, tested, and released.

Common document categories in a CMO QMS include:

• Master batch records (one per product, per client)
• Executed batch records (one per lot, per product)
• Product-specific SOPs covering client-defined manufacturing steps
• Analytical methods and method validation reports by product
• Cleaning validation protocols covering each piece of shared equipment
• Equipment qualification records for any equipment used in a client’s process

Each of these document types must be version-controlled, approved through a defined review and sign-off workflow, and retrievable by product, lot number, or equipment ID. Document change notifications must be directed to the appropriate personnel based on which products or processes a change affects.

Without a configurable QMS, CMOs typically rely on document numbering conventions and spreadsheet trackers that break down as the client roster grows. Electronic QMS platforms with configurable document templates and multi-level approval workflows reduce the time quality teams spend on document administration while improving compliance reliability.

Validation requirements for CMO equipment and processes

Equipment qualification and process validation at CMOs must cover two categories of use: the CMO’s own standard processes and equipment used for one or more clients’ specific products.

For shared equipment, cleaning validation is a recurring requirement. FDA and EU GMP both require demonstrated removal of residues from previous products before shared equipment is used for the next product. For CMOs manufacturing multiple clients’ products on shared filling lines, mixers, or packaging equipment, cleaning validation protocols and execution records must be maintained per product changeover.

Process validation for pharmaceutical CMOs follows FDA’s three-stage approach: process design (Stage 1), process qualification (Stage 2), and continued process verification (Stage 3). CMOs that propose to manufacture a new product for a client must ensure their equipment and process conditions fall within validated ranges before commercial production begins.

For medical device CMOs, process validation under QMSR must cover any process where the resulting output cannot be verified by subsequent inspection or testing. This commonly applies to sterilization, welding, adhesive bonding, and coating processes.

Managing inspections and audits as a contract manufacturer

CMOs face inspections from two directions simultaneously: regulatory agencies conducting their own scheduled or for-cause inspections, and clients exercising their audit rights under quality agreements.

FDA Form 483 observations issued to a CMO can create downstream problems for every client whose products are manufactured there. A manufacturing site placed on import alert or issued a Warning Letter may be unable to ship products until FDA concerns are resolved, which affects every client regardless of whether their specific product was implicated in the finding.

A well-organized CMO QMS supports inspection readiness by maintaining current and accessible records, keeping CAPA timelines on track, and documenting management review outputs that demonstrate the quality system is working as intended. The inspection plan should be reviewed and updated at least annually to reflect current product scope, validated processes, and any changes since the last inspection.

How Cloudtheapp supports contract manufacturer QMS requirements

Cloudtheapp’s AI-powered QMS platform is built for the multi-client, multi-product complexity that defines contract manufacturing. With 60+ configurable applications across document control, CAPA, supplier qualification, audit management, batch records, change control, and more, it lets CMOs build a single QMS that adapts to different client requirements without duplicating infrastructure.

The platform’s no-code configuration tools allow quality teams to create product-specific document templates, client-specific approval workflows, and role-based access controls that keep each client’s records appropriately segregated. Integration capabilities connect the QMS to ERP and LIMS systems, enabling real-time traceability from purchase orders through batch release.

FDA validation documentation is included with every platform update, removing the revalidation burden that typically follows a system upgrade. For CMOs managing multiple client qualification timelines, this means one validation package covers the platform change regardless of how many clients use it.

If you’re evaluating a QMS platform for your contract manufacturing operation, schedule a demo to see how Cloudtheapp handles multi-client document control, supplier qualification, and audit readiness in a single configured system.

Conclusion

A QMS for contract manufacturers must do more than satisfy a single regulatory framework. It must accommodate quality agreement obligations to multiple clients, manage supplier qualification across shared material supply chains, and support inspection readiness from both regulators and client auditors simultaneously. CMOs that build configurable, electronic quality systems rather than paper-based or spreadsheet-driven processes spend less time on administrative overhead and more time on the quality activities that actually reduce risk. The difference shows up in fewer deviations, faster release timelines, and audit reports with fewer findings.

This post created by and appeared first on Cloudtheapp

FDA quality agreement requirements apply to every contract manufacturing arrangement in pharma, biotech, and medical device. A quality agreement defines which party bears responsibility for each GMP activity. FDA inspectors look for three specific failure patterns: absence of an agreement, vagueness in responsibility language, and currency gaps where agreements have not kept pace with operational changes. All three patterns generate FDA Form 483 observations and can escalate to Warning Letters.

FDA Quality Agreement Requirements: What Contract Manufacturers and CMOs Need in Writing

The moment a pharmaceutical, biotech, or medical device company contracts out any GMP-regulated activity, a critical compliance obligation attaches: a written quality agreement must define, clearly and in detail, which party owns each regulatory responsibility. That obligation is not discretionary.

FDA's November 2016 guidance, Contract Manufacturing Arrangements for Drugs: Quality Agreements (docket FDA-2013-D-0558), states the agency's expectation explicitly. Quality agreements should be executed before manufacturing begins, should cover every GMP activity within the contracted scope, and must assign unambiguous responsibilities to a named party. For medical device manufacturers, 21 CFR 820.50 under the Quality Management System Regulation (QMSR) imposes parallel purchasing-control requirements that effectively demand the same level of documented oversight. For Active Pharmaceutical Ingredient manufacturers working with contract facilities, ICH Q7 Section 16 sets the applicable GMP standard.

What ties these frameworks together is a straightforward premise: a contract does not transfer regulatory responsibility. Both the contract giver (the brand owner or NDA/ANDA holder) and the contract acceptor (the CMO or contract lab) remain independently accountable to FDA. The quality agreement is the mechanism through which each party's obligations are made visible, specific, and enforceable.

The most practical starting point for any quality or regulatory affairs team responsible for managing CMO relationships is a clear understanding of what FDA inspectors actually cite during inspections, and why.

The Three FDA 483 Observation Patterns Every Quality Team Should Know

FDA inspectors who review outsourced manufacturing arrangements generate FDA Form 483 observations in one of three recurring patterns. Recognizing these patterns allows quality leads to conduct gap assessments before an inspector arrives.

Pattern 1: Absence

The most straightforward observation is also the simplest to write and the hardest to defend: no written quality agreement exists. FDA has cited both contract givers and contract acceptors for this deficiency under 21 CFR 211.22 (quality unit responsibilities) and the agency's own 2016 guidance on contract manufacturing arrangements.

Absence observations typically read: "There is no written quality agreement in place with the contract manufacturer" or "Failure to establish a written contract with the contract facility."

The risk level is high. An absence finding is among the most likely to escalate from a 483 observation to a Warning Letter action, because it signals to FDA that the organization has not established even the foundational structure for GMP oversight of outsourced operations. The 2016 guidance is explicit: agreements should be in place before any contracted activity begins, not retroactively drafted in response to inspection findings.

Both parties in a contract manufacturing arrangement are vulnerable to this citation. A CMO that operates without quality agreements across multiple client relationships is as exposed to this observation as the brand owner who failed to require one.

Pattern 2: Vagueness

The vagueness pattern arises when a quality agreement exists but fails to allocate responsibilities with sufficient specificity. This is the most common of the three patterns and appears across a wide range of compliance contexts: batch release authority, deviation ownership, stability testing obligations, and annual product review assignments.

Common observation language for this pattern includes: "The quality agreement does not adequately define the responsibilities of each party," "The written agreement fails to specify which party is responsible for investigations of failures," and "The agreement does not define notification timelines or escalation procedures."

FDA inspectors routinely compare the written agreement against the practices actually observed during an inspection. Language such as "as mutually agreed" or "as appropriate," used without further definition, consistently draws scrutiny. Agreements that leave batch release criteria ambiguous or fail to specify which party maintains original batch records versus certified copies are particularly vulnerable to this citation.

A vague agreement is in many ways more dangerous than an absent one. It creates the false impression of compliance while providing no actual protection. When a quality event occurs, an unclear quality agreement ensures that neither party can demonstrate it met its obligations. Vagueness observations under a GMP quality agreement also complicate CAPA response, because investigators then question whether the agreement was ever intended to govern actual practice.

Pattern 3: Currency

The currency pattern affects organizations that initially drafted a solid, compliant quality agreement but have not kept it current as operations, processes, or regulatory requirements changed. FDA expects quality agreements to reflect the actual state of the manufacturing relationship at the time of inspection.

Currency observations include language such as: "The quality agreement has not been updated to reflect current manufacturing processes," "The written agreement does not reflect changes to the contracted scope," and "The agreement fails to address [regulatory requirement] implemented after the agreement was executed."

This is the most frequently overlooked pattern in internal compliance reviews. Quality teams that performed thorough work at contract initiation often miss the ongoing obligation to review and update agreements at defined intervals, after process changes, after regulatory changes, or following significant deviations. A quality agreement CMO arrangement requires a living document, not a one-time deliverable.

What a Compliant Quality Agreement Must Contain

FDA's 2016 guidance provides the most structured framework of required elements for a quality agreement contract manufacturer arrangement. These elements cover the full lifecycle of a manufacturing relationship, from initial qualification through product disposition.

Scope of Contracted Activities

The agreement must open with a precise description of the contracted activities. This includes the specific drug products or device components covered, the manufacturing steps performed at the contract facility, and any analytical or testing services within the contract scope. Imprecise scope definitions are a primary driver of vagueness observations. The scope section should identify the facility by name and address, the specific manufacturing steps executed there, and any activities explicitly excluded from the agreement.

Responsibility Allocation

Every GMP activity within scope must be assigned to a named party. This includes who performs in-process testing, who conducts final release testing, who holds authority to release or reject batches, who maintains original batch records, who owns regulatory filings, and who is responsible for CGMP training at the contract site.

FDA emphasizes that both parties must retain a quality unit capable of independently fulfilling its obligations. The quality agreement should not allow one party's quality unit to substitute for or absorb the responsibilities of the other. Both quality units must be named in the agreement, with their respective approval authorities stated explicitly.

Change Control

Change control provisions are among the most scrutinized sections of any 21 CFR quality agreement. The agreement must specify what types of changes require notification, which changes require prior written approval from the contract giver, and what timelines govern each notification category.

A Process Change Notification provision should address manufacturing process changes, site changes, equipment changes, raw material substitutions, and new regulatory submissions. The agreement should define tiered change categories with different notification timelines: for example, major changes requiring 30-day prior written approval versus minor changes requiring 10-day notification before implementation. Failure to specify timelines is a direct path to a currency observation in future inspections.

Deviations and CAPA

The agreement must define how deviations at the contract site are identified, documented, communicated, and resolved. This includes who initiates the Deviation Report, within what timeframe critical deviations are communicated to the contract giver, and which party owns the Root Cause Investigation.

Deviation CAPA ownership must also be explicit. The agreement should state whether the contract acceptor or the contract giver owns corrective and preventive action implementation and follow-up verification, what escalation procedures apply when a CAPA is not closed on schedule, and how CAPA effectiveness checks are documented and shared across the parties.

Audit Rights

The quality agreement must grant the contract giver the right to conduct Audits of the contract facility, including access to GMP records, procedures, and manufacturing areas. ICH Q7 Section 16.4 requires this provision specifically for API manufacturers. FDA's 2016 guidance reinforces that audit access must be available both to the contract giver and to regulatory authorities.

The agreement should specify audit frequency, advance notice requirements, the scope of Process Audit access, and what types of Audit Findings trigger escalation or potential suspension of manufacturing activities.

Review Cycle

A defined review cycle is the structural mechanism that prevents currency observations. The agreement must specify a maximum interval between formal reviews, typically one to two years, as well as triggers for off-cycle reviews: significant deviations, regulatory changes, facility changes, scope expansions, or product line additions. The review cycle provision should also specify who must approve agreement revisions and what approval timelines apply.

Cloudtheapp's Supplier Quality Management module builds review cycle tracking directly into each supplier record, generating automated reminders when a quality agreement approaches its review date. This removes the manual calendar tracking that most organizations rely on, and that most commonly fails.

ICH Q7 Requirements for API Contract Manufacturers

For Active Pharmaceutical Ingredient manufacturers, ICH Q7 Section 16 establishes the GMP standard for contract manufacturing quality agreements. The requirements parallel FDA's 2016 guidance but carry additional specificity for the API supply chain.

ICH Q7 Section 16.3 requires a written and approved contract or formal agreement that defines the GMP responsibilities of each party, including quality measures. Section 16.4 mandates that contracts allow the API manufacturer to audit the contractor for GMP compliance. Section 16.5 specifies that where contract laboratories are involved, the contract must define testing responsibilities, sample release authority, and reference sample retention obligations. Section 16.6 prohibits the contractor from subcontracting any work to a third party without prior written evaluation and approval from the API manufacturer.

ICH Q7 also introduces obligations that cross-reference other sections of the guideline. A quality agreement covering API contract manufacturing must address materials management (Section 7), laboratory controls and out-of-specification handling (Section 11), change control (Section 13), rejection and rework authority (Section 14), and complaint and recall notification procedures (Section 15). An ICH Q7-compliant agreement is therefore substantially more detailed than a general commercial services agreement and requires input from both the quality unit and regulatory affairs at the time of drafting.

21 CFR 820.50 and QMSR Purchasing Controls for Medical Device Manufacturers

Medical device manufacturers operating under the QMSR face FDA quality agreement requirements through a parallel regulatory pathway: 21 CFR 820.50, which governs purchasing controls.

Under 21 CFR 820.50, device manufacturers must establish and maintain procedures to ensure that all purchased or received products and services conform to specified requirements. This includes evaluating and selecting suppliers based on their ability to meet specified requirements, and defining the extent of control based on that evaluation and the potential effect on device quality.

The purchasing controls framework requires written quality agreements with CMOs and critical component suppliers because, without them, a manufacturer cannot demonstrate what requirements it communicated, how it verified compliance, or what obligations it placed on the contract facility. FDA investigators who review purchasing controls will request supplier agreements as a matter of routine. The absence or inadequacy of those agreements becomes an observation under 21 CFR 820.50.

The QMSR's harmonization with ISO 13485 reinforces this further. ISO 13485 Clause 7.4 requires documented procedures for supplier evaluation, selection, monitoring, and re-evaluation, with records maintained as evidence of conformity. A quality agreement functions as both the specification document and part of the supplier conformity record.

Quality Agreement Management at Scale

For organizations managing multiple CMO relationships, the operational challenge is not drafting a single compliant agreement. The challenge is maintaining a controlled, current, and auditable portfolio of agreements across a supplier network that changes over time.

This is where a purpose-built supplier quality platform creates a measurable compliance advantage. Cloudtheapp's supplier qualification and contract management capabilities allow quality teams to store quality agreements against supplier records, set automated review cycle reminders, link agreement provisions directly to audit findings, and maintain a complete Audit Trail of every revision, approval, and review event.

Rather than relying on spreadsheet trackers and calendar reminders, quality teams get an always-current view of which agreements are due for review, which suppliers have open audit findings that may trigger agreement updates, and which change notifications require agreement amendments. That visibility is the operational foundation for preventing currency observations before they occur.

The Compliance Case for Getting Quality Agreements Right

FDA quality agreement requirements are not a paperwork exercise. They are the regulatory scaffolding that makes outsourced manufacturing controllable and defensible under inspection. A well-structured quality agreement contract manufacturer arrangement assigns clear ownership to every GMP activity, establishes the communication protocols that prevent quality events from falling between parties, and creates the documented basis for demonstrating control of the supply chain.

The three observation patterns that FDA inspectors repeatedly cite are preventable. Each has a direct fix: execute the agreement before manufacturing begins, write it with unambiguous responsibility language, and build a defined review cycle into the agreement itself. For API manufacturers, ICH Q7 Section 16 provides an additional layer of specificity that should be treated as the floor, not the ceiling. For device manufacturers, 21 CFR 820.50 purchasing controls demand the same rigor through a different regulatory path.

Organizations that treat quality agreements as living governance documents rather than static contracts are better positioned in every inspection, every audit, and every quality event that crosses a CMO boundary.

Ready to bring your supplier quality management and CMO oversight under a single, FDA-validated platform? Request a demo of Cloudtheapp's Supplier Quality Management and compliance modules, or start your 30-day free trial today.

This post created by and appeared first on Cloudtheapp